Systems, methods, and apparatus to identify media devices

ABSTRACT

Systems, methods, and apparatus to identify media devices are disclosed. An example method includes establishing a table of device identifiers and respective media access control (MAC) addresses corresponding to devices on a home network, the device identifiers provided by a panelist associated with the home network during a registration process. The home network is monitored for a network communication sent by a requesting device separate from a network communications monitor, the network communications monitor installed in the home network associated with a panelist home. A device identifier of the requesting device is identified from the table of device identifiers and respective MAC addresses based on a MAC address of the requesting device. In response to a failure to identify the device identifier, the panelist is prompted to provide the device identifier for the requesting device.

RELATED APPLICATION

This patent arises from a continuation of U.S. patent application Ser.No. 15/588,245, filed on May 5, 2017, and entitled “SYSTEMS, METHODS,AND APPARATUS TO IDENTIFY MEDIA DEVICES,” which is a continuation ofU.S. patent application Ser. No. 13/931,750, filed on Jun. 28,2013, andentitled “SYSTEMS, METHODS, AND APPARATUS TO IDENTIFY MEDIA DEVICES”,which claims the benefit of U.S. Provisional Application Ser. No.61/814,782, which is entitled “SYSTEMS, METHODS, AND APPARATUS TOIDENTIFY MEDIA DEVICES” and was filed on Apr. 22, 2013. U.S. patentapplication Ser. No. 15/588,245, U.S. patent application Ser. No.13/931,750, and U.S. Provisional Application Ser. No. 61/814,782 arehereby incorporated by reference in their entireties.

FIELD OF THE DISCLOSURE

This disclosure relates generally to monitoring network activity, and,more particularly, to systems, methods, and apparatus to identify mediadevices.

BACKGROUND

Media providers and/or metering entities such as, for example,advertising companies, broadcast networks, etc. are often interested inthe viewing, listening, and/or media behavior/interests of audiencemembers and/or the public in general. To collect thesebehavior/interests, an audience measurement company may enlist panelists(e.g., persons agreeing to be monitored) to cooperate in an audiencemeasurement study for a period of time.

The media usage habits of these panelists as well as demographic dataabout the panelists is collected and used to statistically determine thesize and demographics of an audience.

In recent years, more consumer devices have been provided with Internetconnectivity and the ability to retrieve media from the Internet. Assuch, media exposure has shifted away from conventional methods ofpresentation, such as broadcast television, towards presentation viaconsumer devices accessing the Internet to retrieve media for display.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of an example system to identify mediapresentation devices.

FIG. 2 is a block diagram of an example configuration of the mediadevices shown in FIG. 1.

FIG. 3 is a block diagram of another example configuration of the mediadevices shown in FIG. 1.

FIG. 4 is a block diagram of an example network communications monitorto implement the network communications monitor of FIG. 1.

FIG. 4A is an example address resolution protocol (ARP) table that maybe stored by the example network communications data store of theexample network communications monitor of FIGS. 1 and/or 4 to associatean Internet protocol (IP) address with a media access control (MAC)address.

FIG. 4B is an example MAC address to device identifier table that may bestored by the example network communications data store of the examplenetwork communications monitor of FIGS. 1 and/or 4 to associate a mediaaccess control (MAC) address with a device identifier.

FIG. 5 is a block diagram of an example network activity measurementsystem to implement the example network activity measurement system ofFIG. 1.

FIG. 5A is an example communication log that may be stored by theexample network communications data store of the example networkactivity measurement system of FIGS. 1 and/or 5.

FIG. 6 is a flowchart representative of example machine-readableinstructions which may be executed to implement the example networkcommunications monitor of FIGS. 1 and/or 4 to identify networkcommunications.

FIG. 7 is a flowchart representative of example machine-readableinstructions which may be executed to implement the example networkcommunications monitor of FIGS. 1 and/or 4 to identify networkcommunications.

FIG. 8 is a flowchart representative of example machine-readableinstructions which may be executed to implement the example networkcommunications monitor of FIGS. 1 and/or 4 to transmit networkcommunications.

FIG. 9 is a flowchart representative of example machine-readableinstructions which may be executed to implement the example networkactivity measurement system of FIGS. 1 and/or 5 to identify mediadevices.

FIG. 10 is a block diagram of an example processor platform capable ofexecuting the example machine-readable instructions of FIGS. 6, 7, 8,and/or 9 to implement the example network activity measurement system ofFIGS. 1 and/or 5, and/or the example network communications monitor ofFIGS. 1 and/or 4.

DETAILED DESCRIPTION

As used herein, the term “media” includes any type of content and/oradvertisements, such as television programming, radio programming, news,movies, web sites, etc. Example methods, apparatus, and articles ofmanufacture disclosed herein identify media devices and/or types ofmedia devices for media measurement. Such media devices may include, forexample, Internet-enabled televisions, personal computers,Internet-enabled mobile handsets (e.g., a smartphone), video gameconsoles (e.g., Xbox®, Playstation® 3), tablet computers (e.g., aniPad®), digital media players (e.g., a Roku® media player, a Slingbox®,etc.), etc. In some examples, identifications of media devices used inconsumer locations (e.g., homes, offices, etc.) are aggregated todetermine ownership and/or usage statistics of available media devices,relative rankings of usage and/or ownership of media devices, types ofuses of media devices (e.g., whether a device is used for browsing theInternet, streaming media from the Internet, etc.), and/or other typesof media device information.

In some disclosed examples, a media device includes a network interfaceto transmit a request for media to be presented by the media device. Insuch examples, the media device requests media from a media provider viaa network (e.g., the Internet). In some examples, the request for mediais a HyperText Transfer Protocol (HTTP) request, a Session InitiationProtocol (SIP) message, a domain name service (DNS) query, a filetransfer protocol (FTP) request, and/or any other type of request formedia (e.g., content and/or advertisements).

Internet Service Providers (ISPs) typically provide a single publicInternet protocol (IP) address for each media exposure measurementlocation (e.g., a media presentation location, a panelist household, aninternet café, an office, etc.) receiving Internet services. In someexamples, multiple devices (e.g., media devices) are communicativelycoupled by a local area network (LAN) at a media exposure measurementlocation. In some examples, the LAN includes a router and/or gatewaythat accesses another network (e.g., the Internet) using a public IPaddress associated with the media exposure measurement location.

Within the LAN, individual media devices are given private IP addressesby, for example, a dynamic host control protocol (DHCP.) When a mediadevice within the LAN transmits a request to a resource outside of theLAN (e.g., on the Internet,) the router and/or gateway translates theoriginating (private) IP address of the device making the query to thepublic address of the router and/or gateway before relaying the requestoutside of the LAN (e.g., to the Internet). Thus, when the resourceoutside of the LAN receives the request, the resource is able totransmit a return message (e.g., a response) to the LAN. On the returnpath, the router and/or gateway translates the destination IP address ofthe response to the private IP address of the requesting device so thatthe return message may be delivered to the media device that made theoriginal request.

Some networks utilize Internet Protocol (IP) for communication. The IPaddress scheme utilizes IP addresses assigned to media devices. Forexample, a media device might be assigned an IP version 4 (IPv4) addressof 192.168.0.2. Any other past, present, and or future addressing schememay additionally or alternatively be used such as, for example, IPversion 6 (IPv6). In some examples, IP addresses are dynamicallyassigned using DHCP. Both public and private IP addresses may beassigned using DHCP. In some examples, the IP address assignment isreferred to as a lease. IP address leases are generally time-dependentin that they are only valid for a particular period of time (e.g., oneday, one week, one month, etc.) After the expiration of the lease, themedia device requests a new IP address from a DHCP server (e.g., arouter, a server, etc.). Accordingly, more than one IP address might beassociated with a media device over an extended period of time. Forexample, at a first time, the media device might be identified by an IPaddress of 192.168.0.2, while at a second time, the media device mightbe identified by an IP address of 192.168.0.3. Further, a second mediadevice may be assigned the first IP address at the second time.Accordingly, identifying which device is associated with networkrequests occurring on a network based on the IP address alone isdifficult.

Network interfaces of media devices are provided with a media accesscontrol (MAC) address. The MAC address is a serial number of the networkinterface of the media device. MAC addresses are used when issuing IPaddresses to identify the media device to which the IP address isassigned. Unlike an IP address, the MAC address does not change overtime. The MAC address of a media device is provided by the hardwaremanufacturer of the media device at the time of manufacture. In someexamples, the MAC address may be changed at a later time (e.g., aftermanufacturing the device). In examples disclosed herein, the MAC addressis a forty-eight bit identifier, and is typically represented as atwelve character hexadecimal identifier. However, any otherrepresentation may additionally or alternatively be used. For example,the MAC address convention may change over time to use different numbersand/or types of characters.

In some examples, the MAC address includes a twenty-four bitorganizationally unique identifier (OUI). An OUI is used to identify themanufacturer and/or model of the media device. In some examples, thefirst twelve bits of the OUI identify a manufacturer, while the secondtwelve bits of the OUI identify a model of the device. Accordingly, amanufacturer and/or model of a device may be identified based on theOUI. The OUI, however, does not distinguish between multiple mediadevices of the same manufacturer and model. For example, a first iPadmay have the same OUI as a second iPad. However, the devices will beuniquely identified by the remainder of the MAC address (e.g., theportion of the MAC address following the OUI).

When transmitting network communications (e.g., transmission controlprotocol (TCP) communications, user datagram protocol (UDP)communications, etc.) the MAC address of the media device is notincluded. Rather, the IP address is used to identify the media device.As disclosed above, the IP address may change over time and, therefore,may not accurately identify the media device. To translate an IP addressinto a MAC address, media devices include an address resolution protocol(ARP) table. However, any other type of table may additionally oralternatively be used such as, for example a neighbor discovery protocol(NDP) (e.g., for use with IP version 6 (IPv6)). The ARP table enablestranslation from an IP address to a MAC address. The ARP table ismaintained by media devices (e.g., a router and/or a gateway).Accordingly, a media device can be associated with networkcommunications even though the IP address associated with the mediadevice may change.

In some examples, network resources (e.g., servers providing media tothe media devices) are identified by domain names. Domain names arehuman readable identifiers that identify a network resource. While an IPaddress of a network resource might change over time, the domain nametypically remains the same. Domain names typically remain the samebecause they are purchased by the media provider as a way for users toeasily identify the service provided by the service provider. As the IPaddress of the media provider changes (e.g., because the media provideris now hosting their service via a different server, etc.), the domainname is updated to be associated with the most recent IP address.

In some examples, media devices that are capable of individually beingmonitored via an on-device meter are used within the media exposuremeasurement location. The monitored media device may be, for example, apersonal computer, a smart phone, a tablet, etc. In some examples, theon-device meter collects monitoring information regarding the networkcommunications and/or activities of the media device. In some examples,the on-device meter collects information in addition to the networkcommunications of the monitored media device such as, for example,indicia of user input, indicia of information presented by the monitorednetwork device, etc.

However, not all media devices are amenable to being monitored by anon-device meter. For example some media devices do not allowinstallation of third-party software (e.g., an on-device meter).Further, because of the many types of media devices available,maintaining software packages for every type of media device isdifficult. Because installation of a monitoring system on all types ofnetwork devices is difficult, if not impossible, some network devicesmay go unmonitored.

In examples disclosed herein, a device identifier is used to identifythe media device. For example, a media device may be associated with apanelist and/or a household, and may receive a unique device identifier(e.g., “Suzie's iPAD”, “Smith Family iPad 01”, etc.) to facilitate suchassociation. In some examples, the MAC address is associated with thedevice identifier. In examples disclosed herein, the assignment of theunique device identifier and the association with a MAC address of thedevice is made by an installer (e.g., a representative of a mediamonitoring entity) and/or by a user of the media device. However, anyother party may assign and/or associate the device identifier with themedia device and/or the MAC address of the media device.

In examples disclosed herein, a network communications monitor is usedto capture network communications of media devices on the network (e.g.,a home network). The network communications monitor is installed at themedia exposure measurement location and identifies networkcommunications to and/or from media devices within the media exposuremeasurement location (e.g., the communications of devices sharing apublic IP address via, for example, a gateway). Thus, the networkcommunications monitor monitors all network devices within the mediaexposure measurement location. The network communications monitorcreates a log and/or a record of the network communications, identifiesa device associated with the network communications (e.g., a device thatoriginated and/or is to receive the network communication), andelectronically transmits the log and/or the record to the networkactivity measurement system (e.g., to an audience measurement such asThe Nielsen Company (US), LLC). In examples disclosed herein, thenetwork communications monitor determines a device identifier of theidentified device based on a MAC address of the device involved in thenetwork communications. While the MAC address is not contained in thenetwork communications itself, it can be derived by using, for example,an address resolution protocol (ARP) lookup. In some examples, the logof network communications created by the network communications monitormay be transmitted by physically mailing the log (e.g., a log stored ona memory device such as, for example, a flash memory, a compact disc, aDVD, etc.)

Some example methods, apparatus, and articles of manufacture disclosedherein are located at a media exposure measurement location having oneor more media devices. Some of these example methods, apparatus, andarticles of manufacture are interposed between the media devices and awide area network (WAN), such as the Internet, that includes one or moremedia providers that provide media in response to request(s) from themedia devices. Some example methods, apparatus, and articles ofmanufacture disclosed herein intercept messages to and/or from the WAN(e.g., media requests (e.g., HTTP requests) from media devices on thesame LAN as the intercepting method, apparatus, or article ofmanufacture.) When intercepting messages to and/or from the WAN, in someexamples, the network communications monitor identifies an internal(e.g., private) IP address associated with the intercepted message(e.g., a destination IP address or a source IP address). In someexamples, the internal IP address is used when determining the MACaddress of the media device associated with the intercepted message.

Some example methods, apparatus, and articles of manufacture disclosedherein inspect the network communications to determine if the networkcommunications should be recorded. Not all network requests are ofinterest to the monitoring entity. For example, when the networkcommunications monitor identifies hypertext transfer protocol (HTTP)requests, the network communications are transmitted to a networkactivity measurement system and/or stored for transmission to thenetwork activity measurement system at a later time. In contrast, whenthe network communications monitor identifies a message not associatedwith media presentation (e.g., a border gateway protocol (BGP) message),the network communications monitor may ignore such a message. In someother examples, the message may be ignored when a device identifierand/or a MAC address cannot be determined. Some such example methods,apparatus, and articles of manufacture additionally or alternativelydetermine ownership and/or usage statistics based on messages from theWAN to the media devices on the LAN. Some example methods, apparatus,and articles of manufacture disclosed herein determine the type(s) ofmedia device based on the network communications (e.g., via HTTP queriescontained in the communications, via a MAC address associated with themedia device, via a device identifier associated with the media device,etc.) but, unlike media providers that track usage statistics, do notreturn media to the media device(s) in response to the networkcommunications.

FIG. 1 is a block diagram illustrating an example system 100 to identifymedia devices shown in an example environment of use. The example systemof FIG. 1 includes a network activity measurement system 110, and anetwork communications monitor 180. The network communications monitor180 monitors communications across a network 125. The exampleenvironment of FIG. 1 includes the network 125, an example mediaexposure measurement location 140, and an example media provider 130.The example media exposure measurement location 140 of FIG. 1 includesan example network gateway 145, an example modem 143, and examplenetwork devices 150. The network gateway 145 is able to communicatewith, for example, the example media provider 130 via the network 125.In the illustrated example, network devices 150 include a first mediadevice 151, a second media device 152, a third media device 153, afourth media device 154, and a fifth media device 155.

The network activity measurement system 110 of the illustrated examplecomprises a server 111 that collects and processes networkcommunications from the media devices 150 to generate media deviceinformation. The server 111 of the network activity measurement system110 of FIG. 1 analyzes the network communications across multiplemeasurement locations such as the example measurement location 140 toidentify, for example, which media devices are the most owned, themost-frequently used, the least-frequently owned, the least-frequentlyused, the most/least-frequently used for particular type(s) and/orgenre(s) of media, and/or any other media statistics or aggregateinformation that may be determined from the data. The media deviceinformation may also be correlated or processed with factors such asgeodemographic data (e.g., a geographic location of the media exposuremeasurement location, age(s) of the panelist(s) associated with themedia exposure measurement location, an income level of a panelist,etc.) Media device information may be useful to manufacturers and/oradvertisers to determine which features should be improved, determinewhich features are popular among users, identify geodemographic trends,occurrence(s) related to and/or behaviors of (e.g., demographic group(s)in physical geographic area(s) (e.g., North America, the South EasternUS, etc.)) with respect to media devices, identify market opportunities,and/or otherwise evaluate their own and/or their competitors' products.In some examples, the network activity measurement system is a centralmeasurement system that receives and/or aggregates monitoringinformation collected at multiple different measurement sites.

The network 125 of the illustrated example of FIG. 1 is a wide areanetwork (WAN) such as the Internet. However, in some examples, localnetworks may additionally or alternatively be used. For example,multiple networks may be utilized to couple the components of theexample system 100 to identify media devices.

In the illustrated example, the media devices 150 of FIG. 1 are devicesthat retrieve media from the media provider 130 (e.g., via gateway 145)for presentation at the media exposure measurement location 140. In someexamples, the media devices 150 are capable of directly presenting media(e.g., via a display) while, in some other examples, the media devices150 present the media on separate media presentation equipment (e.g.,speakers, a display, etc.). The first media device 151 of theillustrated example is an Internet enabled television, and thus, iscapable of directly presenting media (e.g., via an integrated displayand speakers). The second media device 152 of the illustrated example isa first gaming console (e.g., Xbox®, Playstation® 3, etc.) and requiresadditional media presentation equipment (e.g., a television) to presentmedia. The third media device 153 and the fourth media device 154 aretablet devices. In the illustrated example, the third media device 153and the fourth media device 154 are the same type of device from thesame manufacturer (e.g., both the third media device 153 and the fourthmedia device 154 are Apple iPads). Accordingly, the OUI (e.g., amanufacturer and/or device specific portion of the MAC address) of thethird media device 153 and the fourth media device 154 are the same. Thefifth media device 155 of the illustrated example is a second gamingconsole (e.g., Xbox®, Playstation® 3, etc.) and requires additionalmedia presentation equipment (e.g., a television) to present media.Although the fifth media device 155 and the second media device 152 areboth gaming consoles, they are not made by the same manufacturer and,accordingly, do not share the same OUI. While, in the illustratedexample, an Internet enabled television, gaming consoles, and tabletdevices are shown, any other type(s) and/or number(s) of media device(s)may additionally or alternatively be used. For example, Internet-enabledmobile handsets (e.g., a smartphone), tablet computers (e.g., an iPad®,a Google Nexus, etc.) digital media players (e.g., a Roku® media player,a Slingbox®, etc.,) etc. may additionally or alternatively be used.Further, while in the illustrated example five media devices are shown,any number of media devices may be used. In the illustrated example,media devices 150 may be wired devices (e.g., connected to the networkcommunications monitor 180 via wired connection such as, for example, anEthernet connection) the media devices 150 may additionally oralternatively be wireless devices (e.g., connected to the networkcommunications monitor 180 via a wireless connection such as, forexample, a WiFi connection, a Bluetooth connection, etc.)

The media provider 130 of the illustrated example of FIG. 1 includes aserver 131 providing media (e.g., web pages, videos, images,advertisements, etc.). The media provider 130 may be implemented by anyprovider(s) of media such as a digital broadcast provider (e.g., a cabletelevision service, a fiber-optic television service, etc.) and/or anon-demand digital media provider (e.g., Internet streaming video and/oraudio services such as Netflix®, YouTube®, Hulu®, Pandora®, Last.fm®)and/or any other provider of media services (e.g., streaming mediaservices). In some other examples, the media provider 130 is a host fora web site(s). Additionally or alternatively, the media provider 130 maynot be on the Internet. For example, the media provider may be on aprivate and/or semi-private network (e.g., a LAN.)

The media exposure measurement location 140 of the illustrated exampleof FIG. 1 is a panelist household. However, the media exposuremeasurement location 140 may be any other location, such as, for examplean internet café, an office, an airport, a library, a non-panelisthousehold, etc. While in the illustrated example a single media exposuremeasurement location 140 is shown, any number and/or type(s) of mediaexposure measurement locations may be used.

The modem 143 of the illustrated example of FIG. 1 is a modem thatenables network communications of the media exposure measurementlocation 140 to reach the network 125. In some examples, the modem 143is a digital subscriber line (DSL) modem, while in some other examplesthe modem 143 is a cable modem. In some examples, the modem 143 is amedia converter that converts one communications medium (e.g.,electrical communications, optical communications, wirelesscommunications, etc.) into another type of communications medium. In theillustrated example, the modem 143 is separate from the network gateway145. However, in some examples, the modem 143 may be a part of (e.g.,integral to) the network gateway 145.

The example network gateway 145 of the illustrated example of FIG. 1 isa router that enables the media devices 150 to communicate with thenetwork 125 (e.g., the Internet). In some examples, the example networkgateway 145 includes gateway functionality such as modem capabilities.In some other examples, the example network gateway 145 is implementedin two or more devices (e.g., a router, a modem, a switch, a firewall,etc.).

In some examples, the example network gateway 145 hosts a LAN for themedia exposure measurement location 140. In the illustrated example, theLAN is a wireless local area network (WLAN) that communicates wirelesslywith the media devices 150, and allows the media devices 150 to transmitand receive data via the Internet. Alternatively, the network gateway145 may be coupled to such a LAN.

The network communications monitor 180 of the illustrated example ofFIG. 1 is a network device interposed between the LAN hosted by theexample network gateway 145 and the network 125. Additionally oralternatively, the network communications monitor 180 may be a device onthe LAN and/or integrated into the gateway 145. The networkcommunications monitor 180 of the illustrated example identifies networkcommunications from the media devices 150 within the media exposuremeasurement location 140. The network communications monitor 180 createsa record (e.g., a log) identifying which of the media device(s) 150 wereinvolved in which of the network communications and transmits the recordto the network activity measurement system 110. In some examples, thenetwork communications monitor 180 determines which device was involvedin the network communications by inspecting the network communicationspassing through the network communications monitor 180 for indicia thatmay identify the media device and/or may facilitate identification ofthe media device (e.g., an IP address that may be used to lookup a MACaddress via an ARP table).

In some examples, the example network gateway 145 permits customfirmware and/or software to be loaded and/or executed. In some suchexamples, the network gateway 145 may be provided with firmware and/orsoftware to implement the network communications monitor 180 (in wholeor in part). In such an example, in addition to standard routing and/ormodem behavior, the firmware and/or software monitors messages and/ordata packets directed from the media devices 150 to the network 125and/or directed from the network 125 to the media devices 150. As notedabove, such monitoring functionality may be part of and/or shared with aseparate device such as, for example, the network communications monitor180.

FIG. 2 is a block diagram of an example configuration 200 of the localarea network shown in FIG. 1. In the example configuration 200 of theillustrated example, the network communications monitor 180 is placedbetween the network 125 and the modem 143. The modem 143 communicateswith the network gateway 145, which in turn communicates with the mediadevices 150.

In the illustrated example, the network communications monitor 180monitors communications between the modem 143 and the network 125. Forexample, when the modem 143 is a DSL modem the network communicationsmonitor 180 monitors the DSL communications. In the illustrated example,the network communications monitor 180 includes one or more ports (e.g.,a DSL port, a cable port, etc.) for receiving and/or transmittingnetwork communications.

FIG. 3 is a block diagram of another example configuration 300 of theLAN shown in FIG. 1. In the example configuration 300 of FIG. 3, thenetwork communications monitor 180 is placed between the network gateway145 and the media devices 150. Thus, the modem 143 communicates with thenetwork gateway 145. The network gateway 145 communicates with the mediadevices 150, and those communications pass through the networkcommunications monitor 180.

In the illustrated example of FIG. 3, the network communications monitor180 monitors communications between the network gateway 145 and themedia devices 150. In some examples, the network communications monitor180 is a network routing device (e.g., a router, a switch, a hub, etc.)that monitors network communications. In the illustrated example,because the modem 143 and the network gateway 145 are adjacent, they maybe combined into a single device. For example, a combined gateway andmodem device may additionally or alternatively be used. In someexamples, the network communications monitor 180 is additionally oralternatively integrated in the network gateway and/or in the modem 143.

FIG. 4 is a block diagram of an example network communications monitor180 to implement the network communications monitor 180 of FIG. 1. Theexample network communications monitor 180 of FIG. 4 includes a networkcommunicator 405, a communications processor 410, a communications datastorer 415, a communications data store 420, a communicationstransmitter 425, and a device information receiver 430.

The network communicator 405 of the illustrated example of FIG. 4 is anEthernet interface. In the illustrated example, the network communicator410 receives network communications (e.g., HTTP requests, etc.) from thenetwork gateway 145, the media devices 150, and/or the modem 143. Thenetwork communicator 405 transmits the network communications to thenetwork 125, and receives and/or transmits network communications in thereverse path (e.g., towards the LAN). While in the illustrated example,the network communicator 405 is an Ethernet interface, any other type ofinterface may additionally or alternatively be used. For example, thenetwork communicator 405 might include one or more of a Bluetoothinterface, a WiFi interface, a digital subscriber line (DSL) interface,a T1 interface, etc. While in the illustrated example a single networkcommunicator 405 is shown, any number and/or type(s) of networkcommunicators may additionally or alternatively be used. For example,two network communicators (e.g., Ethernet interfaces) may be used. Insuch an example, a first network communicator may receive and/ortransmit network communications to and/or from the network gateway 145while a second network communicator may receive and/or transmit networkcommunications to and/or from the network 125.

The communications processor 410 of the illustrated example of FIG. 4inspects network communications received by the network communicator405. The example communications processor 410 of FIG. 4 is implementedby a processor executing instructions, but it could alternatively beimplemented by an Application Specific Integrated Circuit (ASIC),Digital Signal Processor (DSP), Field Programmable Gate Array (FPGA), orother circuitry. In the illustrated example, the communicationsprocessor 410 filters network communications received by the networkcommunicator 405 to identify network communications of the media devices150. Further, the communications processor 410 identifies the mediadevice 150 involved in the network communications. In examples disclosedherein, the communications processor 410 identifies the media device 150by determining a device identifier of the media device 150 and/or a MACaddress of the media device 150.

The communications data storer 415 of the illustrated example of FIG. 4stores network communications identified by the communications processor410 in the network communications data store 420. The example datastorer 415 of the illustrated example is implemented by a processorexecuting instructions, but it could alternatively be implemented by anASIC, DSP, FPGA, or other circuitry. The communications processor 410and the data storer 415 may be implemented by the same physicalprocessor. In the illustrated example, network communications identifiedby the communications processor 410 are stored in association with themedia device(s) 150 identified as receiving and/or transmitting networkcommunications.

The network communications data store 420 of the illustrated example ofFIG. 4 may be any device for storing data such as, for example, flashmemory, magnetic media, optical media, etc. Furthermore, the data storedin the network communications data store 420 may be in any data formatsuch as, for example, binary data, comma delimited data, tab delimiteddata, structured query language (SQL) structures, etc. While, in theillustrated example, the network communications data store 420 isillustrated as a single database, the network communications data store420 may be implemented by any number and/or type(s) of databases. In theillustrated example, the network communications data store 420 stores anARP table 401, and a MAC address to device identifier table 402. Anexample implementation of the ARP table 401 is further described inconnection with FIG. 4A. An example implementation of the MAC address todevice identifier table 402 is further described in connection with FIG.4B.

The communications transmitter 425 of the illustrated example of FIG. 4transmits network communications data stored in the networkcommunications data store 420. In the illustrated example, thecommunications transmitter 425 is implemented by a processor executinginstructions, but it could alternatively be implemented by an ASIC, DSP,FPGA, or other circuitry. The communications transmitter 425 may beimplemented on the same physical processor as the communicationsprocessor 410 and/or the communications data storer 415. Thecommunications transmitter 425 of the illustrated example periodicallyand/or a-periodically transmits network communications data from thenetwork communications data store 420 to the network activitymeasurement system 110.

The example communications transmitter 425 may transmit the networkcommunications data upon determining that the amount of networkcommunications data stored in the network communication data store 420has reached a threshold, and/or in response to a clock (e.g., a timelimit specifying that network communications are transmitted once everyday). Transmitting network communications every day ensures that thereis little lag time between the occurrence of the network communicationsand the ability to analyze the network communications. However, thetransmission may occur at any desired interval(s) such as, for example,transmitting once every hour, once every week, etc. In examples in whichthe transmission is triggered based on an amount of networkcommunications data stored in the network communications data store 420,the transmission threshold might indicate that network communicationsshould be transmitted if there is more than a threshold amount (e.g.,one megabyte) of network communications data stored in the networkcommunications data store 420. Any data storage amount may be used forsuch a trigger such as, for example, ten megabytes, one hundredmegabytes, etc. Additionally or alternatively, multiple transmissionthresholds may be present. For example, a threshold indicating thatnetwork communications data should be transmitted at least once a dayand a threshold indicating that network communications data should betransmitted if more than one megabyte of network communications data isstored in the network communications data store 420 might be used.

In the illustrated example, the communications transmitter 425 transmitsthe network communications data via the network 125. However, thecommunications transmitter 425 may transmit network communications datavia any other communication medium. For example, the networkcommunications monitor 180 may be physically mailed to the networkactivity measurement system 110 and the communications transmitter 425might transmit network communications data via, for example, a USBconnection, a Bluetooth connection, a serial connection, a local areanetwork (LAN), etc.

The example device information receiver 430 of the illustrated exampleof FIG. 4 receives and stores device identifiers in association with MACaddresses in the MAC address to device identifier table 402 of thenetwork communications data store 420. In the illustrated example, thedevice information receiver 430 is implemented by a processor executinginstructions, but it could alternatively be implemented by an ASIC, DSP,FPGA, or other circuitry. The device information receiver 430 may beimplemented on the same physical processor as the communicationsprocessor 410, the communications data storer 415, and/or thecommunications transmitter 425. In the illustrated example, the deviceinformation receiver 430 provides a network accessible interface (e.g.,a webpage) that is accessed via a separate device (e.g., a personalcomputer, a tablet computer, etc.). In examples disclosed herein, thedevice information receiver 430 stores a device identifier that isprovided by an installer (e.g., a representative of a media monitoringentity (e.g., an audience measurement entity such as The Nielsen Company(US), LLC) and/or by a user of the media device. For each media deviceon the network, the installer and/or user enters a MAC address of thedevice and a respective device identifier of the corresponding mediadevice into the interface of the device information receiver 430. Thedevice information receiver 430 then stores the association of the MACaddress and the device identifier in the MAC address to deviceidentifier table 402, which may be used to identify the correspondingmedia device at a later time.

FIG. 4A is an example address resolution protocol (ARP) table 401 thatmay be stored by the example network communications data store of theexample network communications monitor of FIGS. 1 and/or 4 to associatean Internet protocol (IP) address with a media access control (MAC)address. The example ARP table 401 is maintained by the networkcommunicator 405. The ARP table 401 is updated by the networkcommunicator 405 as IP addresses of media devices change (e.g., new IPaddresses are issued via DHCP).

The example ARP table 401 of FIG. 4A includes an IP address column 460and a MAC address column 465. In the illustrated example, the IP addresscolumn 460 represents a IP version 4 (IPv4) addresses of media deviceson the LAN. However, any other type of address may additionally oralternatively be used such as, for example, an IPv6 address. In theillustrated example, the MAC address column 465 represents MAC addressesof media devices on the LAN. However, any other type of address mayadditionally or alternatively be used. Each row of the ARP table 401 ofFIG. 4A represents a specific media device (i.e., the IP address and MACaddress of a single media device).

The example ARP table 401 of the illustrated example of FIG. 4A includesfive rows respectively associated with five different media devices onthe LAN. A first row 471 corresponds to the first media device 151. Asecond row 472 corresponds to the second media device 152. A third row473 corresponds to the third media device 153. A fourth row 474corresponds to the fourth media device 154. A fifth row 475 correspondsto the fifth media device 155. In the illustrated example, the first sixcharacters of the MAC address (described above as the OUI) of the thirdrow 473 and the fourth row 474 are the same (e.g., “4C:B1:99”). In theillustrated example, the matching OUI indicates that the third mediadevice 153 and the fourth media device 154 are of the same manufacturerand/or model.

FIG. 4B is an example MAC address to device identifier table 402 thatmay be stored by the example network communications data store of theexample network communications monitor of FIGS. 1 and/or 4 to associatea media access control (MAC) address with a device identifier. Theexample MAC address to device identifier table 402 is updated by thedevice information receiver 430. The example MAC address to deviceidentifier table 402 includes a MAC address column 480 and a deviceidentifier column 485. Because MAC addresses are persistent, theassociation of the MAC address column 480 and the device identifiercolumn 485 is also persistent. That is, device identifiers arepermanently and/or semi-permanently associated with media devices at themedia exposure measurement location 140. The example MAC address todevice identifier table 402 includes five rows respectively associatedwith five different media devices at the media exposure measurementlocation 140. For example, a first iPad in the media exposuremeasurement location 140 is assigned a device identifier of“PANELIST0001_IPAD01” (row 492), while a second iPad in the mediaexposure measurement location is assigned a device identifier of“PANELIST0001_IPAD02” (row 493). The identifier of row 493 indicatesthat the second iPad is associated with the same panelist (e.g., thesame person in the same household). However, the second iPad may beassigned and/or associated with any other device identifier to, forexample, identify a particular panelist within a household (e.g.,“PANELIST0002_IPAD02”, “Suzie's iPad”, etc.).

In the illustrated example of FIG. 4B, the device identifiers associatedwith each of the MAC addresses includes a panelist identifier (e.g.,“PANELIST0001”), a media device type (e.g., “XBOX”, “PLAYSTATION”,“IPAD”, “SMARTTV”, etc.), and a serial identifier (e.g., “01”). However,the device identifier may be formatted and/or constructed in any otherfashion. In the illustrated example, the device identifier is a uniqueidentifier that is not shared across media devices and/or media exposuremeasurement location 140. However, in some examples, the deviceidentifier is not unique across multiple media exposure measurementlocation (but is preferably unique within a single media exposuremeasurement location). In such examples, the device identifier may becombined with a network communications monitor identifier and/or mediaexposure measurement location identifier (e.g., a unique identifierassigned to the panelist and/or panelist household).

FIG. 5 is a block diagram of an example implementation of the examplenetwork activity measurement system 110 of FIG. 1. The example networkactivity measurement system 110 of FIG. 5 includes a communicationsreceiver 520, a communications analyzer 540, and a networkcommunications data store 510.

The communications receiver 520 of the illustrated example of FIG. 5receives network communications data from the example networkcommunications monitor 180 shown in FIGS. 1 and 4. In the illustratedexample, the communications data receiver 520 is implemented by aprocessor executing instructions, but it could alternatively beimplemented by an ASIC, DSP, FPGA, or other circuitry. In theillustrated example, the communications receiver 520 is implemented by aserver which receives the network communications from the networkcommunications monitor 180 via a network interface (e.g., an Ethernetconnection). However, the communications receiver 520 may receive thenetwork communications from the network communications monitor 180 viaany other type of interface such as, for example, a universal serial bus(USB) connection, a Bluetooth connection, etc. The communicationsreceiver 520 of the illustrated example stores the received networkcommunications in the network communications data store 510.

The network communications data store 510 of the illustrated example ofFIG. 5 may be implemented by any type(s) and/or number of device(s)and/or storage disks for storing data such as, for example, flashmemory, magnetic media, optical media, etc. Furthermore, the data storedin the network communications data store 510 may be in any dataformat(s) such as, for example, binary data, comma delimited data, tabdelimited data, structured query language (SQL) structures, etc. While,in the illustrated example, the network communications data store 510 isillustrated as a single database, the network communications data store510 may be implemented by any number and/or type(s) of databases. In theillustrated example, the example network communications data store 510stores the MAC address to device identifier table 402, and acommunication log 501. The communication log 501 is described in furtherdetail in connection with FIG. 5A.

The communications analyzer 540 of the illustrated example of FIG. 5analyzes communications from the network devices 150 (received via thenetwork communications monitor 180 and the communications receiver 520).In the illustrated example, the communications analyzer 540 isimplemented by a processor executing instructions, but it couldalternatively be implemented by an ASIC, DSP, FPGA, or other circuitry.The communications analyzer 540 may be implemented on the same physicalprocessor as the communications receiver 520. The example communicationsanalyzer 540 of FIG. 5 is implemented by a server which analyzes thecommunications from the media devices 150 to determine, for example,ownership and/or usage statistics of the media devices 150, relativerankings of usage and/or ownership of media devices 150, type(s) of usesof media devices 150 (e.g., whether a device is used for browsing theInternet, streaming media from the Internet, etc.), and/or other type(s)of network device information.

FIG. 5A is an example communication log 501 that may be stored by theexample network communications data store 510 of the example networkactivity measurement system 110 of FIGS. 1 and/or 5. The examplecommunication log 501 is transmitted to the network activity measurementsystem 110 by the network communications monitor 180. In the illustratedexample, for simplicity, the communication log 501 representscommunications received from a single network communications monitor 180(e.g., network communications monitored at a single media exposuremeasurement location 140). However, in practice, the communication log501 may represent communications received from multiple networkcommunications monitors 180, associated with many different mediaexposure measurement locations 140. In the illustrated example, thecommunication log 501 includes a device identifier column 560, atimestamp column 563, and a network data column 566. The deviceidentifier column 560 represents device identifiers as received from thenetwork communications monitor 180 (and/or as translated by thecommunications analyzer 540 based on the MAC address). The timestampcolumn 563 represents a timestamp (e.g., a time of occurrence)associated with the network data of the network data column 566. Theexample network data column 566 includes HTTP headers of networkcommunications monitored by the network communications monitor 180.However, any other information related to the communications mayadditionally or alternatively be stored such as, for example, an HTTPpayload, FTP data, HTTPS data, etc.

The example data of the communications log 501 indicates that at a firsttime, the first media device 151 transmitted a request to “www.hulu.com”(row 570). Such a request indicates that the first media device 151 wasused to present media retrieved from hulu. At a second time, the fourthmedia device 154 transmitted a request to “www.engadget.com” (row 571).The first media device then transmitted a request to “www.netflix.com”at a third time (row 572), and then another request to the samedestination at a fourth time (row 573). The fourth media device 154 thentransmitted a request to “www.cnet.com” at a fifth time (row 574). Basedon the network data, the communications analyzer 540 may, for example,determine ownership and/or usage statistics of the media devices 150,determine relative rankings of usage and/or ownership of media devices150, determine demographics that may more frequently use a particulartype of media device, determine demographics that may more frequentlyuse a particular media device for a certain function (e.g., streamingtelevision, internet browsing, etc.), types of uses of media devices 150(e.g., whether a device is used for browsing the Internet, streamingmedia from the Internet, etc.), and/or other types of network deviceinformation and/or media usage information (e.g., exposure statisticsfor various demographic groups).

While an example manner of implementing the network activity measurementsystem 110 of FIG. 1 has been illustrated in FIG. 5 and an examplemanner of implementing the network communications monitor 180 of FIG. 1has been illustrated in FIG. 4, one or more of the elements, processesand/or devices illustrated in FIGS. 4 and/or 5may be combined, divided,re-arranged, omitted, eliminated and/or implemented in any other way.Further, the example network communicator 405, the examplecommunications process 410, the example communications data storer 415,the example network communications data store 420, the examplecommunications transmitter 425, the example device information receiver430, and/or, more generally, the example network communications monitor180 of FIGS. 1 and 4 and/or the example network communications datastore 510, the example communications receiver 520, the examplecommunications analyzer 540, and/or, more generally, the example networkactivity measurement system 110 of FIGS. 1 and 5 may be implemented byhardware, software, firmware and/or any combination of hardware,software and/or firmware. Thus, for example, any of the example networkcommunicator 405, the example communications process 410, the examplecommunications data storer 415, the example network communications datastore 420, the example communications transmitter 425, the exampledevice information receiver 430, and/or, more generally, the examplenetwork communications monitor 180 of FIGS. 1 and 4 and/or the examplenetwork communications data store 510, the example communicationsreceiver 520, the example communications analyzer 540, and/or, moregenerally, the example network activity measurement system 110 of FIGS.1 and 5 could be implemented by one or more analog or digitalcircuit(s), logic circuits, programmable processor(s), applicationspecific integrated circuit(s) (ASIC(s)), programmable logic device(s)(PLD(s)) and/or field programmable logic device(s) (FPLD(s)). Whenreading any of the apparatus or system claims of this patent to cover apurely software and/or firmware implementation, at least one of theexample network communicator 405, the example communications process410, the example communications data storer 415, the example networkcommunications data store 420, the example communications transmitter425, the example device information receiver 430, and/or, moregenerally, the example network communications monitor 180 of FIGS. 1 and4 and/or the example network communications data store 510, the examplecommunications receiver 520, the example communications analyzer 540,and/or, more generally, the example network activity measurement system110 of FIGS. 1 and 5 is/are hereby expressly defined to include atangible computer readable storage device or storage disk such as amemory, a digital versatile disk (DVD), a compact disk (CD), a Blu-raydisk, etc. storing the software and/or firmware. Further still, theexample network activity measurement system 110 of FIGS. 1 and/or 5,and/or the example network communications monitor 180 of FIGS. 1 and/or4 may include one or more elements, processes and/or devices in additionto, or instead of, those illustrated in FIGS. 1, 4, and/or 5, and/or mayinclude more than one of any or all of the illustrated elements,processes and devices.

Flowcharts representative of example machine readable instructions forimplementing the example network communications monitor 180 of FIGS. 1and/or 4 are shown in FIGS. 6, 7, and/or 8. Flowcharts representative ofexample machine readable instructions for implementing the examplenetwork activity measurement system 110 of FIGS. 1 and/or 5 is shown inFIG. 9. In these examples, the machine readable instructions comprise aprogram for execution by a processor such as the processor 1012 shown inthe example processor platform 1000 discussed below in connection withFIG. 10. The program may be embodied in software stored on a tangiblecomputer readable storage medium such as a CD-ROM, a floppy disk, a harddrive, a digital versatile disk (DVD), a Blu-ray disk, or a memoryassociated with the processor 1012, but the entire program and/or partsthereof could alternatively be executed by a device other than theprocessor 1012 and/or embodied in firmware or dedicated hardware.Further, although the example program is described with reference to theflowcharts illustrated in FIGS. 6, 7, 8, and/or 9, many other methods ofimplementing the example network activity measurement system 110 ofFIGS. 1 and/or 5, and/or the example network communications monitor 180of FIGS. 1 and/or 4 may alternatively be used. For example, the order ofexecution of the blocks may be changed, and/or some of the blocksdescribed may be changed, eliminated, or combined.

As mentioned above, the example processes of FIGS. 6, 7, 8, and/or 9 maybe implemented using coded instructions (e.g., computer and/or machinereadable instructions) stored on a tangible computer readable storagemedium such as a hard disk drive, a flash memory, a read-only memory(ROM), a compact disk (CD), a digital versatile disk (DVD), a cache, arandom-access memory (RAM) and/or any other storage device or storagedisk in which information is stored for any duration (e.g., for extendedtime periods, permanently, for brief instances, for temporarilybuffering, and/or for caching of the information). As used herein, theterm tangible computer readable storage medium is expressly defined toinclude any type of computer readable storage device and/or storage diskand to exclude propagating signals. As used herein, “tangible computerreadable storage medium” and “tangible machine readable storage medium”are used interchangeably. Additionally or alternatively, the exampleprocesses of FIGS. 6, 7, 8, and/or 9 may be implemented using codedinstructions (e.g., computer and/or machine readable instructions)stored on a non-transitory computer and/or machine readable medium suchas a hard disk drive, a flash memory, a read-only memory, a compactdisk, a digital versatile disk, a cache, a random-access memory and/orany other storage device or storage disk in which information is storedfor any duration (e.g., for extended time periods, permanently, forbrief instances, for temporarily buffering, and/or for caching of theinformation). As used herein, the term non-transitory computer readablemedium is expressly defined to include any type of computer readabledevice or disk and to exclude propagating signals. As used herein, whenthe phrase “at least” is used as the transition term in a preamble of aclaim, it is open-ended in the same manner as the term “comprising” isopen ended.

FIG. 6 is a flowchart representative of example machine-readableinstructions 600 which may be executed to implement the example networkcommunications monitor 180 of FIGS. 1 and 4 to monitor networkcommunications. The machine-readable instructions 600 of FIG. 6 beginexecution when the network communicator 405 receives networkcommunications (block 610). In the illustrated example, the networkcommunicator 405 receives network communications sent from the networkgateway 145 to the network 125 and/or a device on the network 125.However, in some examples, the network communicator 405 also receivesnetwork communications sent from the network 125 and/or a device on thenetwork 125 to the network gateway 145.

The communications processor 410 then determines the internal IP addressof the media device involved in the network communication (block 620).In some examples, the media device may be the source (e.g., theoriginator) of the network communication, while in some other examplesthe media device may be the destination of the network communication. Inthe illustrated example, the communications processor 410 identifies theIP address by selecting an internal IP address involved in thecommunications. In some examples, the network communication may involveboth a source and a destination that are internal to the LAN (e.g., afirst media device on the LAN communicates with a second media device onthe LAN). In such examples, the communications processor 410 may ignorethe network communication. However, in some examples, the communicationsprocessor 410 may select the IP address of the source of the networkcommunication as the IP address.

The communications processor 410 then performs a lookup of the MACaddress based on the IP address (block 630). In the illustrated example,the communications processor 410 performs the lookup via the ARP table401. The ARP table is maintained by the example network communicator 405of the network communications monitor 180. However any other way ofdetermining the MAC address of the IP address associated with thenetwork communications may be used. The communications processor 410then determines the device identifier based on the MAC address (block640). In the illustrated example, the communications processor 410determines the device identifier based on the MAC address identified bythe lookup of block 630. However, in some examples, the communicationsprocessor 410 may determine the device identifier based on the IPaddress. In such an example, the network communicator 405 may maintain atable storing relationships between IP addresses of media devices on thenetwork and their respective device identifiers. The communicationsprocessor 410 determines whether the device identifier can be resolvedbased on the MAC address (block 650).

If the device identifier can be resolved, the communications data storer415 stores data identifying the network communication in associationwith the device identifier in the network communications data store 420(block 670). If the device identifier cannot be resolved, the reason fornot being resolved is likely that a new device has been added to thenetwork. To account for such a situation, if the device identifiercannot be resolved, the communications processor 410 sends an alert tothe network activity measurement system 110 of a new device added to thenetwork (block 660). Such an alert enables the monitoring entityassociated with the network activity measurement system 110 to contactthe panelist (e.g., the homeowner) to inquire about the new device. If,for example, the panelist confirms to that a new device has been added,a device identifier may be issued for the new device. In some examples,an installer may be sent to the media exposure measurement location 140to identify the media device 150 and/or the MAC address of the mediadevice 150. The installer may interact with the device informationreceiver 430 to enter the device identifier and the MAC address of themedia device so that the association can be recorded in the MAC addressto device identifier table 402. In some examples, the installer maydirect and/or otherwise instruct a user of the media device to interactwith the device information receiver 430. For example, the installer mayconduct a telephone call with the user to convey such instructions.While in the illustrated example, the installer is described as anactive party (e.g., a party that actively inputs information into aninterface of the device information receiver 430, a party that instructsa user of the media device to do the same, etc.), in some examples theinstaller may be a set of instructions (e.g., an instruction booklet, anemail message, a SMS message, etc.) that instructs the user to enter andevice identifier of a media device via an interface of the deviceinformation receiver. If a new device has not been added (e.g., themedia device was temporarily used at the media exposure measurementlocation 140, for instance, by a house guest), a device identifier maynot be issued. If the device identifier cannot be resolved, thecommunications data storer 415 stores data identifying the networkcommunication in association with the MAC address in the networkcommunications data store 420 (block 665).

In the illustrated example, the communications processor 410 timestampsthe network communications stored in the network communications datastore 410 (block 680). Timestamping (e.g., recording a time that anevent occurred) enables accurate identification and/or correlation ofmedia that was presented.

In some examples, the communications processor 410 inspects the networkcommunications to identify HTTP communications. That is, thecommunications processor 410 and/or the communications data storer 415may store network communications only when the communications are HTTPcommunications. In such an example, the HTTP communications are storedin the network communications data store 420 by the communications datastorer 415. In some examples, the communications processor 410 inspectsthe network communications to identify a type and/or protocol of networkcommunication (e.g., HTTP communications, DNS communications, SIPcommunications, FTP communications, etc.) by for example, inspecting aheader of network communication (e.g., a transmission control packet(TCP) header, a user datagram protocol (UDP) header). In some examples,the communications processor 410 inspects the network communications toidentify a source and/or a destination of the network communications byfor example, inspecting a header of network communication (e.g., atransmission control packet (TCP) header, a user datagram protocol (UDP)header). In such an example, communications might only be stored whenthey are requests transmitted to particular providers of Internetservices (e.g., Netflix®, YouTube®, Hulu®, Pandora®, Last.fm®, etc.)and/or when the communications originated from a particular type ofnetwork device (e.g., an Internet enabled television, a video gameconsole, etc.), depending on the nature of the study.

In some examples, the communications processor 410 processes thereceived network communications to identify particular portion(s) of thenetwork communications. For example, to reduce the amount of storagespace required to store the network communications, the communicationsprocessor 410 may remove and/or compress one or more portion(s) of thenetwork communications.

FIG. 7 is a flowchart representative of example machine-readableinstructions 700 which may be executed to implement the example networkcommunications monitor 180 of FIGS. 1 and 4 to monitor networkcommunications. In some examples, the MAC address to device identifiertable 402 is stored at the network activity measurement system 110rather than at that the network communications monitor 180. In such anexample, the network communications monitor 180 may not be able todetermine a device identifier and may instead store the networkcommunication in association with the MAC address. As described above,FIG. 6 illustrates example instructions 600 which, when executed,attempt to identify the media device using a device identifier. Incontrast, FIG. 7 illustrates example instructions 700 which, whenexecuted, attempt to identify the media device based on a MAC address,leaving for a translation from MAC address to device identifier to beperformed at the network activity measurement system 110.

The machine-readable instructions 700 of FIG. 7 begin execution when thenetwork communicator 405 receives network communications (block 710). Inthe illustrated example, the network communicator 405 receives networkcommunications sent from the network gateway 145 to the network 125and/or a device on the network 125. However, in some examples, thenetwork communicator 405 also receives network communications sent fromthe network 125 and/or a device on the network 125 to the networkgateway 145.

The communications processor 410 then determines the internal IP addressof the media device involved in the network communication (block 720).In some examples, the media device may be the source (e.g., theoriginator) of the network communication, while in some other examplesthe media device may be the destination of the network communication. Inthe illustrated example, the communications processor 410 identifies theIP address by selecting an internal IP address involved in thecommunications. In some examples, the network communication may involveboth a source and a destination that are internal to the LAN (e.g., afirst media device on the LAN communicates with a second media device onthe LAN). In such examples, the communications processor 410 may ignorethe network communication. However, in some examples, the communicationsprocessor 410 may select the IP address of the source of the networkcommunication as the IP address.

The communications processor 410 then performs a lookup of the MACaddress based on the IP address (block 730). In the illustrated example,the communications processor 410 performs the lookup via the ARP table401. In the illustrated example, the ARP table is maintained by theexample network communicator 405 of the network communications monitor180. However any other way of determining the MAC address of the IPaddress associated with the network communications may be used.

The communications data storer 415 stores data identifying the networkcommunication in association with the MAC address in the networkcommunications data store 420 (block 750). The network communication andthe associated MAC address may be transmitted to the network activitymeasurement system 110 at a later time. In the illustrated example, thecommunications processor 410 timestamps the network communicationsstored in the network communications data store 410 (block 760).Timestamping (e.g., recording a time that an event occurred) enablesaccurate identification and/or correlation of media that was presentedand also enables alignment of the media identification data withaudience composition data collected by, for example, a people meter tothereby enable correlation of an audience demographic to media exposure.

FIG. 8 is a flowchart representative of example machine-readableinstructions 800 which may be executed to implement the example networkcommunications monitor 180 of FIGS. 1 and 4 to transmit stored networkcommunications. The machine-readable instructions 800 of FIG. 8 beginexecution at block 805 when the communications transmitter 425determines whether a network communications threshold has been exceeded(block 810). In the illustrated example, the threshold is a time limitspecifying that network communications are transmitted once every day.Additionally or alternatively, any other periodic and/or aperiodicapproach to transmitting network communications from the networkcommunications monitor 180 may be used. For example, the networkcommunications threshold might be based on an amount of networkcommunications data stored in the network communications data store 420.

If the network communications threshold has not been exceeded (block810), the communications transmitter 425 continues to determine whetherthe data identifying the network communications have exceeded thenetwork communications threshold. When the network communicationsthreshold has been exceeded (block 810), the communications transmitter425 transmits the data identifying the network communications to thenetwork communications data receiver 340 of the network activitymeasurement system 110 as a log of network activity (block 820). In theillustrated example, the data identifying the network communications istransmitted in association with an identifier of the networkcommunications monitor 180. The identifier of the network communicationsmonitor 180, in some examples, enables identification of the source ofnetwork communications analyzed by the communications analyzer 540 ofthe network activity measurement system 110.

In the illustrated example, the communications transmitter 425 transmitsthe stored network communications via the network communicator 405.However, in some examples, the communications transmitter 425 transmitsthe stored network communications via a local connection such as, forexample, a serial connection, a universal serial bus (USB) connection, aBluetooth connection, etc. In some examples, the network communicationsmonitor 180 may be physically moved to a location of the networkactivity measurement system 110 by, for example, physically mailing thenetwork communications monitor 180, etc.

FIG. 9 is a flowchart representative of example machine-readableinstructions 900 which may be executed to implement the example networkactivity measurement system 110 of FIGS. 1 and 5 to identify mediadevices. In particular, the example flowchart of FIG. 9 illustrates anexample process wherein the network activity measurement system 110receives network communications from the network communications monitor180 and analyzes the same. The example machine-readable instructions 900of FIG. 9 begin execution when the communications receiver 520 receivesnetwork communications from the network communications monitor 180(block 910). In the illustrated example, the network communications arereceived from the network communications monitor 180 via a networkconnection, such as, for example, the Internet. However, the networkcommunications data may be received in any other fashion. For example,the network communications data may be received via a universal serialbus (USB) connection. In such an example, the network communicationsmonitor 180 may be mailed to a location of the network activitymeasurement system 110. Additionally or alternatively, a storage device(e.g., a memory stick, a compact disk, a hard disk drive, etc.) may bemailed and/or otherwise sent to the network activity measurement system.Upon receiving the network communications data, the communicationsreceiver 520 stores the network communications in the networkcommunications data store 510.

In some examples, the MAC address to device identifier table 402 isstored at the network communications data store 510 of the networkactivity measurement system 110. In such an example, the communicationsanalyzer 540 determines if the received network communications arereceived in association with a device identifier (block 920). If thenetwork communications are not received in association with a deviceidentifier (block 920) (e.g., the network communications are received inassociation with a MAC address), the communications analyzer 540determines if a device identifier can be resolved based on the MACaddress (block 930). Such a determination is made by the communicationsanalyzer 540 by performing a lookup in the MAC address to deviceidentifier table 402. If the device identifier can be resolved based onthe MAC address, the communications analyzer 950 translates the MACaddress identifier into the device identifier (block 950).

If the device identifier cannot be resolved based on the MAC address, analert is thrown by the communications analyzer 540. Such an alertenables the monitoring entity associated with the network activitymeasurement system 110 to contact the panelist (e.g., the homeowner) toinquire about the new device. In the illustrated example, the alertidentifies the identifier of the network communications monitor 180, sothat the monitoring entity associated with the network activitymeasurement system 110 can contact the correct panelist and/or householdregarding the newly added device. If, for example, the panelist confirmsthat a new device has been added, a device identifier may be issued forthe new device and/or may be stored in the MAC address to deviceidentifier table. In some examples, an installer may be sent to themedia exposure measurement location 140 to identify the new media device150 and/or the MAC address of the new media device 150. If a new devicehas not been added (e.g., the media device was temporarily used at themedia exposure measurement location 140), a device identifier may not beissued.

If the device identifier cannot be resolved, the communications analyzer540 identifies the media device 150 associated with the networkcommunications based on the MAC address (block 960). For example, thecommunications analyzer may parse the MAC address to identify an OUI ofthe MAC address. Because the OUI is manufacturer and/or model specific,the communications analyzer 540 can identify a make and/or model of themedia device associated with the network communication. In a similarregard, the identification of the make and/or model of the media devicemay be useful when contacting the panelist for inquiring about the newlyadded device. For example, the make and/or model may facilitatequestioning the panelist to confirm whether a particular new device hasbeen added to the network (e.g., “Have you recently added an Apple iPadto your network? If so, is that device associated with a particular userin the household?”). If the panelist answers in the affirmative, adevice identifier indicating that the device is associated with thepanelist (e.g., “PANELIST0005_IPAD”) may be stored in association withthe MAC address of the device in the MAC address to device identifiertable 402.

If the network communications are associated with a device identifier(block 920), after the MAC address is translated to the deviceidentifier (block 950), and/or after a manufacturer and/or model of themedia device is identified based on the MAC address (block 960), thecommunications analyzer 540 analyzes the communications from the mediadevices 150 to identify media devices (block 970). In the illustratedexample, the example communications analyzer 540 analyzes thecommunications to determine ownership and/or usage statistics of themedia devices 150. However, in some examples, the example communicationsanalyzer 540 may additionally or alternatively analyze thecommunications to determine relative rankings of usage and/or ownershipof media devices 150, types of uses of media devices 150 (e.g., whethera device is used for browsing the Internet, streaming media from theInternet, etc.), and/or other types of media device information.

FIG. 10 is a block diagram of an example processor platform 1000 capableof executing the instructions of FIGS. 6, 7, 8, and/or 9 to implementthe example network activity measurement system 110 of FIGS. 1 and/or 5,and/or the example network communications monitor 180 of FIGS. 1 and/or4. The processor platform 1000 can be, for example, a server, a personalcomputer, a mobile device (e.g., a cell phone, a smart phone, a tabletsuch as an iPad™) a personal digital assistant (PDA), an Internetappliance, a set top box, or any other type of computing device.

The processor platform 1000 of the illustrated example includes aprocessor 1012. The processor 1012 of the illustrated example ishardware. For example, the processor 1012 can be implemented by one ormore integrated circuits, logic circuits, microprocessors or controllersfrom any desired family or manufacturer.

The processor 1012 of the illustrated example includes a local memory1013 (e.g., a cache). The processor 1012 of the illustrated example isin communication with a main memory including a volatile memory 1014 anda non-volatile memory 1016 via a bus 1018. The volatile memory 1014 maybe implemented by Synchronous Dynamic Random Access Memory (SDRAM),Dynamic Random Access Memory (DRAM), RAMBUS Dynamic Random Access Memory(RDRAM) and/or any other type of random access memory device. Thenon-volatile memory 1016 may be implemented by flash memory and/or anyother desired type of memory device. Access to the main memory 1014,1016 is controlled by a memory controller.

The processor platform 1000 of the illustrated example also includes aninterface circuit 1020. The interface circuit 1020 may be implemented byany type of interface standard, such as an Ethernet interface, auniversal serial bus (USB), and/or a PCI express interface.

In the illustrated example, one or more input devices 1022 are connectedto the interface circuit 1020. The input device(s) 1022 permit(s) a userto enter data and commands into the processor 1012. The input device(s)can be implemented by, for example, a keyboard, a button, a mouse, atouchscreen, a track-pad, a trackball, isopoint and/or a voicerecognition system.

One or more output devices 1024 are also connected to the interfacecircuit 1020 of the illustrated example. The output devices 1024 can beimplemented, for example, by display devices (e.g., a light emittingdiode (LED), an organic light emitting diode (OLED), a liquid crystaldisplay, a cathode ray tube display (CRT), a touchscreen, a tactileoutput device, a light emitting diode (LED), a printer and/or speakers).The interface circuit 1020 of the illustrated example, thus, typicallyincludes a graphics driver card, a graphics driver chip or a graphicsdriver processor.

The interface circuit 1020 of the illustrated example also includes acommunication device such as a transmitter, a receiver, a transceiver, amodem and/or network interface card to facilitate exchange of data withexternal machines (e.g., computing devices of any kind) via a network1026 (e.g., an Ethernet connection, a digital subscriber line (DSL), atelephone line, coaxial cable, a cellular telephone system, etc.).

The processor platform 1000 of the illustrated example also includes oneor more mass storage devices 1028 for storing software and/or data.Examples of such mass storage devices 1028 include floppy disk drives,hard drive disks, compact disk drives, Blu-ray disk drives, RAIDsystems, and digital versatile disk (DVD) drives.

The coded instructions 1032 of FIGS. 6, 7, 8, and/or 9 may be stored inthe mass storage device 1028, in the volatile memory 1014, in thenon-volatile memory 1016, and/or on a removable tangible computerreadable storage medium such as a CD or DVD.

Although certain example methods, apparatus and articles of manufacturehave been described herein, the scope of coverage of this patent is notlimited thereto. On the contrary, this patent covers all methods,apparatus and articles of manufacture fairly falling within the scope ofthe claims of this patent.

What is claimed is:
 1. A network communications monitor to identify amedia device, the network communications monitor comprising: a networkcommunicator to connect to a home network associated with a panelisthome, and monitor the home network for a network communication sent by arequesting device separate from the network communications monitor, thenetwork communication having a destination other than the networkcommunications monitor; a communications processor to: store a table ofdevice identifiers and respective media access control addressescorresponding to registered devices on the home network, the deviceidentifiers provided by a panelist associated with the home networkduring a registration process; in response to the network communicatordetecting the network communication transmitted on the home network,attempt to identify a device identifier of the requesting device fromthe table of device identifiers and respective media access controladdresses based on a media access control address of the requestingdevice; and in response to a failure to identify the device identifier,initiate prompting of the panelist to provide a device identifier forthe unidentified device; and a communications data storer to: store dataidentifying the network communication in association with at least oneof the device identifier or the media access control address in anetwork communications data store when the device identifier isidentified, and store the data identifying the network communication inassociation with the media access control address when the deviceidentifier is not identified.
 2. The network communications monitor ofclaim 1, further including a communications transmitter to transmit thedata identifying the network communication to an audience measuremententity.
 3. The network communications monitor of claim 1, furtherincluding a device information receiver to receive an association of themedia access control address and the device identifier.
 4. The networkcommunications monitor of claim 1, wherein the communications processoris to identify the media access control address of the requesting deviceby using an address resolution protocol table.
 5. A method ofidentifying a media presentation device, the method comprising:establishing a table of device identifiers and respective media accesscontrol addresses corresponding to devices on a home network, the deviceidentifiers provided by a panelist associated with the home networkduring a registration process; monitoring, by executing an instructionwith a processor of a network communications monitor, the home networkfor a network communication sent by a requesting device separate fromthe network communications monitor, the network communication having adestination other than the network communications monitor, the networkcommunications monitor installed in the home network associated with apanelist home; attempting to identify a device identifier of therequesting device from the table of device identifiers and respectivemedia access control addresses based on a media access control addressof the requesting device, the device identifier different from the mediaaccess control address; in response to a failure to identify the deviceidentifier, initiate, by executing an instruction with the processor,display of a prompt requesting the panelist to provide the deviceidentifier for the requesting device; and transmitting data identifyingthe network communication and the device identifier to an audiencemeasurement entity.
 6. The method of claim 5, wherein the identifying ofthe media access control address of the requesting device is performedusing an address resolution protocol table.
 7. The method of claim 5,wherein the requesting device is associated with a local area network.8. The method of claim 5, further including attempting to identify atleast one of a make or a model of the requesting device, wherein thedisplaying of the prompt is to question the panelist concerning anaddition of the requesting device having the at least one of the make orthe model to the home network.
 9. The method of claim 5, furtherincluding storing the media access control address in association withthe device identifier.
 10. The method of claim 5, further including, inresponse to the failure to identify the device identifier, storing dataidentifying the network communication in association with the mediaaccess control address.
 11. The method of claim 5, wherein the table ofdevice identifiers and respective media access control addressescorresponding to devices on the home network is stored in a memory ofthe network communications monitor.
 12. A non-transitory machinereadable medium comprising instructions which, when executed, cause anetwork communications monitor to at least: establish a table of deviceidentifiers and respective media access control addresses correspondingto devices on a home network, the device identifiers provided by apanelist associated with the home network during a registration process;monitor the home network for a network communication sent by arequesting device separate from the network communications monitor, thenetwork communication having a destination other than the networkcommunications monitor, the network communications monitor installed inthe home network associated with a panelist home; attempt to identify adevice identifier of the requesting device from the table of deviceidentifiers and respective media access control addresses based on amedia access control address of the requesting device, the deviceidentifier different from the media access control address; in responseto a failure to identify the device identifier, initiate display of aprompt to request that the panelist provide the device identifier forthe requesting device; and transmit data identifying the networkcommunication and the device identifier to an audience measuremententity.
 13. The non-transitory machine readable medium of claim 12,wherein the identifying of the media access control address of therequesting device is performed using an address resolution protocoltable.
 14. The non-transitory machine readable medium of claim 12,wherein the requesting device is associated with a local area network.15. The non-transitory machine readable medium of claim 12, wherein theinstructions, when executed, further cause the network communicationsmonitor to attempt to identify at least one of a make or a model of therequesting device, wherein the displaying of the prompt is to questionthe panelist concerning an addition of the requesting device having theat least one of the make or the model to the home network.
 16. Thenon-transitory machine readable medium of claim 12, wherein theinstructions, when executed, further cause the network communicationsmonitor to store the media access control address in association withthe device identifier.
 17. The non-transitory machine readable medium ofclaim 12, wherein the instructions, when executed, further cause thenetwork communications monitor to, in response to the failure toidentify the device identifier, store data identifying the networkcommunication in association with the media access control address. 18.The non-transitory machine readable medium of claim 12, wherein theinstructions, when executed, further cause the network communicationsmonitor to store the table of device identifiers and respective mediaaccess control addresses corresponding to devices on the home network ina memory of the network communications monitor.
 19. The non-transitorymachine readable medium of claim 12, wherein the instructions, whenexecuted, further cause the network communications monitor to transmit awebpage including the prompt.
 20. The non-transitory machine readablemedium of claim 19, wherein the webpage is to be displayed by a deviceseparate from the network communications monitor.